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AMENDMENTS TO THE CLAIMS: 

This listing of the claims will replace all prior versions, and listings, of the claims in this 
application: 

The Claims: 

1. (Currently Amended) A method, comprising: 

receiving at a broker a usage policy for constraints related to data of a user in a 
communication system, wherein said usage policy defines at least one a strictness level 
param e t e r value for at l e ast on e attribut e in associated with the usage policy , where a 
strictness level value is a value assigned to a collection of privacy attributes ; 

receiving a request for data associated with the user from a service provider in the 
communication system to the broker, wherein the service provider possesses a privacy policy 
and wherein said request comprises at l e ast on e a strictness level param e t e r value for at l e ast 
on e attribute in the privacy polic y associated with the privacy policy of the service provider ; 

checking, in the broker, the request against a usage policy of the user by comparing the 
strictness level parameter valu e s value associated with attribut e s in the usage policy to 
corr e sponding the strictness level param e t e r valu e s value associat e d with corresponding 
attribut e s in the privacy policy received request and associated with the privacy policy of the 
service provider ; and 

sending a response to the service provider indicating whether the data can be released, 
based on the comparison of the strictness level param e ter values associated with attributes in 
the usag e policy to corr e sponding strictn es s l e v e l param e t e r valu e s associat e d with 
corr e sponding attributes the privacy policy . 

2. (Previously Presented) The method of claim 1, wherein the usage policy is defined by 
the user. 

3. (Previously Presented) The method of claim 1, further comprising: providing the 
broker with a predefined set of privacy policies and usage policies. 
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4. (Currently Amended) The method of claim 3, wherein the providing comprises 
providing the privacy policies and the usage policies comprising similar attributes with 
defined strictness level param e t e r values. 

5-6. (Canceled). 

7. (Currently Amended) The method of claim 1, further comprising: releasing user data 
when e ach of said at least on e strictness level param e t e r value for th e at least on e attribut e of 
associated with the privacy policy is less than or equal to the corr e sponding d e fin e d strictness 
level paramet e r value of th e corresponding attribut e in the received usag e policy request . 

8. (Currently Amended) The method of claim 1, further comprising: indicating, in the 
response by the broker, a strictness level param e t e r value of an attribut e of associated with 
the usage policy to the service provider when the corr e sponding strictness level param e t e r 
value of the corr e sponding attribute of associated with the privacy policy of the servic e 
provid e r is greater than the indicat e d strictness level param e t e r value of the attribute in 
associated with the usage policy. 

9. (Currently Amended) The method of claim 1, further comprising: allowing the user to 
reduce a the strictness level param e t e r value of an attribut e in associated with the usage 
policy when the corresponding strictness level param e t e r value of th e corresponding attribut e 
ef- associated with the privacy polic y of th e s e rvic e provider is greater than the strictness level 
parameter value of th e attribute in associated with the usage policy to be r e duced . 

10. (Previously Presented) The method of claim 1, further comprising: attaching an 
electronically signed usage policy to the data when the data is released. 

1 1 . (Currently Amended) A system, comprising: 
a service provider possessing a privacy policy; and 

a broker hosting a usage policy for constraints related to data of a user, wherein said 
usage policy defines at l e ast on e a strictness level param e t e r value for at l e ast on e attribut e in 
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associated with the usage polic y, where a strictness level value is a value assigned to a 
collection of privacy attributes , 

wherein the broker is configured to check a request from the service provider against the 
usage policy of the user by comparing the strictness level param e t e r valu e s value associated 
with attributes in the usage policy to a corresponding strictness level param e ter valu e s value 
associated wit h corresponding attribut e s in the privacy policy of the service provider , wherein 
said request comprises at l e ast on e the strictness level param e t e r value for at least on e 
attribut e in th e privacy policy associated with the privacy policy of the service provider , and 

the broker is configured to send a response to the service provider indicating whether data 
associated with the user can be released in response to the request based on the comparison of 
the strictness level param e t e r values a s sociated with attribut e s in th e usag e policy to 
corresponding strictness lev e l param e t e r valu e s associat e d with corr e sponding attribut e s th e 
privacy policy . 

12. (Currently Amended) A system, comprising: 

introducing means for introducing to a broker a usage policy for constraints related to 
data of a user, wherein said usage policy defines at least one a strictness level param e t e r 
value for at l e ast on e attribut e in associated with the usage policy , where a strictness level 
value is a value assigned to a collection of privacy attributes ; 

receiving means for receiving a request for data associated with the user from a service 
provider to the broker, wherein the service provider possesses a privacy policy and wherein 
said request comprises at least one strictness level param e t e r value for at l e ast on e attribut e in 
associated with the privacy policy; 

checking means for checking, in the broker, the request against a usage policy of the user 
by comparing the strictness level param e t e r valu e s value associated with attribut e s in the 
usage policy to the corr e sponding strictness level param e t e r valu e s value in the received 
request and associated with corresponding attributes in the privacy policy of the service 
provider ; and 

sending means for sending a response to the service provider indicating whether the data 
can be released, based on the comparison of the strictness level parameter values associat e d 
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with attributes in the usage policy to corresponding s trictn e ss l e vel parameter valu e s 
associated with corr e sponding attribut e s th e privacy policy . 



13. (Currently Amended) An apparatus, comprising: 
at least one memory including computer code, 

at least one processor, 

wherein the at least one memory and the computer program code are configured to, with 
the at least one processor, cause the apparatus at least to 

receive a request for data associated with a user from a service provider, wherein the 
service provider possesses a privacy policy and wherein said request comprises at l e ast on e a 
strictness level parameter value for at least one attribut e in associated with the privacy policy^ 
where a strictness level value is a value assigned to a collection of privacy attributes ; 

check the request against a usage policy of the user by comparing the strictness level 
paramet e r valu e s value associat e d with attributes in associated with the usage policy to a 
corresponding strictness level param e t e r values value in the received request and associated 
with corresponding attribut e s in the privacy policy of the service provider , wherein said usage 
policy defines at least on e a strictness level param e t e r value for at least on e attribute in th e 
usage policy associated with the privacy policy of the service provider ; and 

send a response to the service provider indicating whether the data can be released, based 
on the comparison of the strictness level parameter values associat e d with attributes in th e 
usage policy to corresponding strictn e ss l e v e l param e t e r valu e s associat e d with corresponding 
attributes th e privacy policy . 

14. (Currently Amended) The apparatus of claim 13, wherein the at least one memory 
and the computer program code are further configured to, with the at least one processor, 
cause the apparatus at least to release user data when e ach of said at l e ast on e strictness level 
paramet e r value for th e at least one attribut e associated with the privacy policy is less than or 
equal to the corresponding defined strictness level param e t e r value of th e corresponding 
attribut e in associated with the received usage policy. 
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15. (Currently Amended) The apparatus of claim 13, wherein the at least one memory 
and the computer program code are further configured to, with the at least one processor, 
cause the apparatus at least to indicate, in the response, a strictness level param e t e r value of 
an attribut e of the usage policy to the service provider when the corresponding strictness level 
param e t e r value of the corr e sponding attribute of associated with the privacy policy of the 
s e rvice provid e r is greater than the indicat e d strictness level param e ter value of the attribut e 
m associated with the usage policy. 

16. (Currently Amended) The apparatus of claim 13, wherein the at least one memory 
and the computer program code are further configured to, with the at least one processor, 
cause the apparatus at least to allow the user to reduce a the strictness level param e ter value 
of an attribut e in associated with the usage policy when the corr e sponding strictness level 
param e t e r value of th e corr e sponding attribut e of associated with the privacy policy of the 
service provider is greater than the strictness level param e t e r value of th e attribut e in 
associated with t he usage policy to be r e duced . 

17. (Previously Presented) The apparatus of claim 13, wherein the at least one memory 
and the computer program code are further configured to, with the at least one processor, 
cause the apparatus at least to attach an electronically signed usage policy to the data when 
the data is released. 

18. (Currently Amended) An apparatus, comprising: 

receiving means for receiving a request for data associated with a user from a service 
provider, wherein the service provider possesses a privacy policy and wherein said request 
comprises at l e ast on e a strictness level parameter value for at least one attribute in the 
privacy policy associated with the privacy policy of the service provider, where a strictness 
level value is a value assigned to a collection of privacy attributes : 

checking means for checking the request against a usage policy of the user by comparing 
a strictness level parameter values value associated with attribut e s in the usage policy to the 
corr e sponding strictness level param e t e r values value associated with corresponding 
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attributes in the privacy policy, wherein said usage policy defines at l e ast one a strictness 
level parameter value for at l e ast one attribut e in associated with the usage policy; and 

sending means for sending a response to the service provider indicating whether the data 
can be released, based on the comparison of the strictness level parameter values associat e d 
with attributes in the usage policy to corresponding strictn e ss l e vel param e t e r values 
associat e d with corr e sponding attributes the privacy policy . 

19. (Currently Amended) A computer-readable medium comprising computer- 
executable components, the components configured to: 

receive a usage policy for constraints related to data of a user in a communication system, 
wherein said usage policy defines at l e ast one a strictness level param e t e r value for at l e ast 
one attribute in associated with the usage policy , where a strictness level value is a value 
assigned to a collection of privacy attributes ; 

receive a request for data associated with the user from a service provider in the 
communication system, wherein the service provider possesses a privacy policy and wherein 
said request comprises at l e ast on e a strictness level param e t e r value for at least one attribut e 
m associated with the privacy policy; 

check the request against a usage policy of the user by comparing the strictness level 
paramet e r valu e s value associated with attributes in the usage policy to the corresponding 
strictness level param e t e r valu e s value in the received request and associated with 
corresponding attributes in the privacy policy of the service provider ; and 

send a response to the service provider indicating whether the data can be released, based 
on the comparison of the strictness level parameter values associated with attribut e s in th e 
usag e policy to corresponding strictn e ss l e v e l param e t e r valu e s associated with corr e sponding 
attribut e s th e privacy policy . 

20. (Previously Presented) The medium of claim 19, wherein the usage policy is defined 
by the user. 

21. (Previously Presented) The medium of claim 19, wherein the components are 
configured to: receive a predefined set of privacy policies and usage policies. 
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22. (Currently Amended) The medium of claim 21, wherein receiving the predefined set 
comprises receiving the privacy policies and the usage policies comprising similar attributes 
with defined strictness level param e t e r values. 

23-24. (Canceled). 

25. (Currently Amended) The medium of claim 19, wherein the components are 
configured to: release user data when each of said at l e ast on e strictness level param e t e r value 
for the at least one attribut e of associated with the privacy policy is less than or equal to the 
corr e sponding d e fin e d strictness level param e t e r value of th e corr e sponding attribut e in 
associated with the received usage policy. 

26. (Currently Amended) The medium of claim 19, wherein the components are 
configured to: 

indicate, in the response, a strictness level param e t e r value of an attribute of the usage 
policy to the service provider when the corresponding strictness level parameter value of th e 
corresponding attribut e of associated with the privacy policy of the service provider is greater 
than the indicated strictness level param e ter value of the attribute in associated with the usage 
policy. 

27. (Currently Amended) The medium of claim 19, wherein the components are 
configured to: allow the user to reduce a the strictness level param e t e r value of an attribute in 
associated with the usage policy when the corr e sponding strictness level parameter value ef 
the corr e sponding attribute of associated with the privacy policy of the service provider is 
greater than the strictness level param e t e r value of the attribut e in the usage policy to b e 
r e duc e d . 

28. (Previously Presented) The medium of claim 19, wherein the components are 
configured to: attach an electronically signed usage policy to the data when the data is 
released. 
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29. (New) The method of claim 1, where a strictness level value is defined at least in part 
as comprising: 

a "purpose" attribute describing a purposes of data collection or uses of data; 
a "retention" attribute indicating a retention policy; and 

an "access" attribute indicating whether the service provider provides access to collected 
data. 

30. (New) The method of claim 1, where a strictness level value associated with the usage 
policy is "privacy strict", where "privacy strict" is defined at least in part as: the "purpose" 
attribute being assigned a value of "current"; the "retention" attribute being assigned a value 
of "no retention"; and the "access" attribute being assigned a value of "nonident". 
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